Motivation:
HelmChart.AsHelmArgs() appends ReleaseName as the first bare
positional argument to `helm template`, and pullCommand() appends
Name as a bare positional argument to `helm pull` (when a repo is
set and the chart isn't already cached locally). Neither value is
preceded by a `--` delimiter before being handed to exec.Command.
Helm's own flag parser does not distinguish a bare positional
argument from a flag: if a kustomization.yaml sets, for example,
releaseName: --post-renderer=./evil.sh, helm interprets that as a
--post-renderer flag rather than a release name, and executes the
attacker-supplied script during `kustomize build --enable-helm`
(or `kubectl kustomize --enable-helm`). This is a real,
demonstrated flag-injection path reachable from an untrusted
kustomization.yaml plus --enable-helm; it is not a claim about
every possible helm argument, only the two fields that are passed
as bare positionals. Other HelmChart fields (Namespace, ValuesFile,
KubeVersion, etc.) are passed as `--flag value` pairs, where helm's
pflag-based parser consumes the very next token as the flag's value
regardless of its content, so they are not exploitable the same way
and are out of scope for this change.
Approach:
Reject a releaseName or name that starts with '-' in validateArgs(),
which runs during Config() before any helm subprocess is spawned.
The check is added to the plugin source
(plugin/builtin/helmchartinflationgenerator/HelmChartInflationGenerator.go)
and mirrored into the generated copy
(api/internal/builtins/HelmChartInflationGenerator.go) via
`go generate .` (pluginator), matching how this plugin is normally
maintained. A small test harness helper,
ErrorFromLoadAndRunGenerator, was added to
api/testutils/kusttest/harnessenhanced.go, modeled on the existing
ErrorFromLoadAndRunTransformer helper, so the new tests can assert
on the Config()-time validation error without needing an actual
helm binary installed.
Validation:
- `cd api && go build ./... && go vet ./...` pass.
- `cd plugin/builtin/helmchartinflationgenerator && go vet ./...`
passes. (`go build ./...` in that directory fails with "function
main is undeclared" both before and after this change; it's a
//go:generate pluginator source file compiled specially, not a
standalone main package, so plain `go build` there is not
meaningful.)
- Added TestHelmChartInflationGeneratorRejectsFlagLikeReleaseName
and TestHelmChartInflationGeneratorRejectsFlagLikeChartName in
plugin/builtin/helmchartinflationgenerator/HelmChartInflationGenerator_test.go.
Verified both fail-then-pass: with each new HasPrefix check
temporarily removed, `go test ./... -run
TestHelmChartInflationGeneratorRejectsFlagLike... -v` fails with
an "unable to run: helmV3 ... executable file not found" error,
proving execution reaches the real helm subprocess call with the
injected flag; restoring the check makes the same test pass with
the expected "must not start with '-'" error, confirming
validation now happens before any subprocess is spawned.
- `go test ./types/... ./testutils/... ./internal/builtins/...` in
api/ pass. `go test ./krusty/...` has one unrelated pre-existing
failure, TestAddManagedbyLabel, which fails identically on
unmodified master: it expects a version string baked in via
-ldflags during `make test` that plain `go test` does not set.
- golangci-lint v1.64.8 (the version pinned in hack/go.mod, matching
what CI's `make lint` installs) run against the changed packages
is clean.
Report: https://github.com/kubernetes-sigs/kustomize/issues/6241
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Assisted-by: claude-sonnet-5 (via Claude Code)
* fix: performance recession when propagating namespace to helm
* fix: handle passing namespace downstream more elegant
* Revert "fix: handle passing namespace downstream more elegant"
This reverts commit 976a7cf2aa.
* Revert "fix: performance recession when propagating namespace to helm"
This reverts commit c7612d1dba.
* fix: use annotation to identify helm chart generated resources
* fix: deduplicate code
* fix: missing import in NamespaceTransformer.go
* ci: allow manual trigger of pipeline in fork
* Revert "ci: allow manual trigger of pipeline in fork"
This reverts commit 8948788fe2.
* fix: test cases
* chore: fix code comment was on wrong line
* chore: fix code comment was on wrong line pt2
* update go 1.24.6
* fix non-constant format string error
* update golang.org/x/tools@v0.36.0 and github.com/golangci/golangci-lint@v1.64.8 to pass execute golangci-lint
* add a verpose diff output to prow test
* remove pluginator binary version from generated files
* fix: Add test, when an empty patch file is given, it should not fail
* fix: Add code so there's no error given if an empty file is given as a patch
* chore: Generate plugin with pluginator
* chore: fix tests
Signed-off-by: Julio Chana <julio.chana@lokalise.com>
* Add t.helper() at start of test function
Signed-off-by: Julio Chana <julio.chana@lokalise.com>
---------
Signed-off-by: Julio Chana <julio.chana@lokalise.com>
This reverts commit b692e49b1e.
The json-patch bump in k/k was reverted, so the corresponding bump in
kustomize should be reverted too.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
It makes sense to add that as a CLI args since you could use one single
kustomization file/helm chart for multiple clusters. Also it's easier to
have those on the CLI if the user has some kind of tooling that will end
up calling kustomize and that could pass those (i.e.: ArgoCD is doing
that for Helm so it could do that for Kustomize as well that will end up
calling Helm as well).
Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@ledger.fr>
* Fix using same helm chart with different versions
* Fix p.ValuesFile when version is set
* Updated: Fix using same helm chart with different versions
* Add test for issue #4813
* Use if/else for readability, add version check to absChartHome
* fix a patch files accept multiple patches
* fix comments and variable name
* add error handling when using not allowed multiple strategic-merge patches
* fix error message of Multiple Strategic-Merge Patch file
* refactor transformStrategicMerge()
* add TODO comment and test for Multiple JSON patch Yaml documents are not allowed
* refactoring PatchTransformer
* add multiple patch test for PatchTransformer package
* improve error message to PatchTransformer
* refactor const and error message check
* fix some error messages
* Fix using same helm chart with different versions
* Fix p.ValuesFile when version is set
* Updated: Fix using same helm chart with different versions
* Add test for issue #4813
* Use if/else for readability, add version check to absChartHome
* support for more helm template args
* move templateArgs and unit tests to api/types
* undo package name change
* use our own simple helm chart instead of forking one
* add argument to AsHelmArgs
* code review
* lint errors
* api: Add new types for customizeable resource ordering
Signed-off-by: Yannis Zarkadas <yanniszark@arrikto.com>
* plugins: Implement SortOrderTransformer plugin
Implement the SortOrderTransformer plugin. This plugin allows the user
to customize the order that kustomize will output resources in.
The API for the plugin is the following:
sortOptions:
order: legacy | fifo
legacySortOptions:
orderFirst:
- {GVK}
orderLast:
- {GVK}
Signed-off-by: Yannis Zarkadas <yanniszark@arrikto.com>
* plugins: Add boilerplate and generate code for new SortOrderTransformer
Signed-off-by: Yannis Zarkadas <yanniszark@arrikto.com>
* build: Add option to denote if the reorder flag was set by the user
We want to take different actions if the reorder flag was set by the
user or filled by the default value. Thus, we propagate this information
from build to the krusty options.
Signed-off-by: Yannis Zarkadas <yanniszark@gmail.com>
* api/krusty: Ensure sort ordering works with CLI flag and kustomization
Sort order can be defined in two places:
- (new) kustomization file
- (old) CLI flag
We want the kustomization file to take precedence over the CLI flag.
Eventually, we may want to move away from having a CLI flag altogether:
https://github.com/kubernetes-sigs/kustomize/issues/3947
Case 1: Sort order set in kustomization file AND in CLI flag.
Print a warning and let the kustomization file take precedence.
Case 2: Sort order set in CLI flag only or not at all.
Follow the CLI flag (defaults to legacy) and reorder at the end.
Case 3: Sort order set in kustomization file only.
Simply build the kustomization.
Signed-off-by: Yannis Zarkadas <yanniszark@gmail.com>
* krusty: Add e2e test for SortOrderTransformer
Signed-off-by: Yannis Zarkadas <yanniszark@arrikto.com>
* plugins: Purge LegacyOrderTransformer
Signed-off-by: Yannis Zarkadas <yanniszark@gmail.com>
* Update go.work.sum
Signed-off-by: Yannis Zarkadas <yanniszark@gmail.com>
* review: Make review changes
Signed-off-by: Yannis Zarkadas <yanniszark@gmail.com>
Signed-off-by: Yannis Zarkadas <yanniszark@arrikto.com>
Signed-off-by: Yannis Zarkadas <yanniszark@gmail.com>
This commit adds the `skipHooks` option to the helm chart support in order
to expose the --no-hooks flag introduced to Helm in [1].
Using Kustomize to inflate a Helm chart would in some situations result in
different results than using `helm install`. This is because `helm
template`, by default, will render chart tests in the `templates/test`
directory, which can lead to undesired resources in the output.
See [2] for additional discussion.
[1]: https://github.com/helm/helm/pull/6444
[2]: https://github.com/helm/helm/issues/6443
Signed-off-by: Lars Kellogg-Stedman <lars@oddbit.com>
* add tagsuffix to take image tag suffix
* add comments to warn about specifications
* add test and error handle
* fix indent
* update comment
* fix merge errors and return updates
* update image update and fix example
* fix yamls formats
remove tabs in yamls
fix space in image name
tag error in name
* fix spacing issue
format of yaml
set example as above
* spacing of spec in testing templates
* change to switch case
